GHSA-29ph-fjf3-c5cm

ghsaUSosv

Apache NiFi XSS issue in context path handling

view advisory published 2022-05-14Licence: CC-BY-4.0

A malicious `X-ProxyContextPath` or `X-Forwarded-Context` header containing external resources or embedded code could cause remote code execution. The fix to properly handle these headers was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-15697US	critical9.8	4.83% (92nd)	—	2018-01-23
A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fix to properly handle these head…

references

External citations — patches, advisories, analysis.

https://nifi.apache.org/security.html#CVE-2017-15697WEB
https://nvd.nist.gov/vuln/detail/CVE-2017-15697ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan